Uber to pay a penalty of $20,000


In 2014, Uber suffered a data breach where a ton of personal information of drivers including names and license numbers was accessed by an unauthorized third party. The ride-hailing company has now agreed to pay a $20,0000 penalty in a settlement with New York Attorney General Eric T. Schneiderman.

Uber also agreed to tighten employee access to geo-location data of passengers, following reports that the company’s executives had an aerial “God View” of such data, the office of the attorney general said in a statement. The fine was imposed on the company for its delay in providing timely notice of the data breach to the affected drivers and the attorney general’s office.

According to the attorney general’s office, an Uber engineer had posted on Github.com in early 2014 an access ID for Uber’s third-party cloud storage in a post accessible to the public, and by May 12, 2014, someone not linked to Uber had accessed the database that included the driver information.

The company also ran into controversy in 2014 when an Uber executive had used a “God View” tool to track its reporter’s ride without permission. The controversy prompted U.S. Sen. Al Franken, who is also a ranking member of the Senate Subcommittee on Privacy, Technology, and the Law, to question Uber’s privacy policies, including who in the company and for what reason had access to the “God View” tool.

Schneiderman launched an investigation in November 2014 into Uber’s handling of customer personal information it collects, such as names, email addresses, phone numbers and payment information. “Uber also collects the geographic location of riders and drivers in real time,” according to the statement from Schneiderman’s office. But Uber has now agreed under the settlement “to maintain and store GPS-based location information in a password-protected environment, and encrypt the information when in transit.

The company has also agreed to take measures like limiting access to geo-location information to certain employees with a legitimate business purpose, and having technical access controls.

Uber could not be immediately reached for comment on the announcement of the settlement.


Leave a Reply

Your email address will not be published. Required fields are marked *